On Mon, Dec 8, 2014 at 2:28 AM, Bijesh Maskey <[email protected]> wrote: > my server is running on cent os 6 and i have currently two agents runng one > lunix cent os 6 and another windows servr 2008. in both the cases ( in > windows as well as cent os ) i am not getting the log (intrigity check) for > deleted files. please let me know if you need any more information. i can > even copy the indivisual files or upload the vm for you.
What version of OSSEC are you using? > thanks > regards > bijesh > > > On Friday, June 28, 2013 3:07:44 PM UTC+5:45, Rogue Bull wrote: >> >> What OS are you facing this issue on? Which version of OSSEC? What >> comprises of "everything needed" that you did? >> >> You folks need to learn a thing or two when you ask for help on a forum. >> Learn to provide enough details to anyone who might be kind enough to try >> and help you out. Show effort. Give and you shall receive. >> >> On Friday, June 28, 2013 12:02:43 AM UTC+5:30, jigish thakar wrote: >>> >>> Guys >>> >>> Facing the same issue, did everything needed (as far as i know) but still >>> cant see any alert. Also checked archive.log nothing is appearing there. >>> >>> On Thursday, July 19, 2012 6:59:47 PM UTC+5:30, Wagner Thomas wrote: >>>> >>>> Hi! >>>> >>>> >>>> >>>> I'm currently testing OSSEC 2.6 on centOS and basically it works fine. >>>> >>>> Setup was easy to do and also the configuration of manager and agent >>>> went fine. >>>> >>>> >>>> >>>> My problem now is, that I don't get alerts if files are deleted (added >>>> and changed files are reported correctly). >>>> >>>> >>>> >>>> This is my rule for deleted files (nothing changed after the >>>> installation): >>>> >>>> >>>> >>>> <rule id="553" level="7"> >>>> >>>> <category>ossec</category> >>>> >>>> <decoded_as>syscheck_deleted</decoded_as> >>>> >>>> <description>File deleted. Unable to retrieve >>>> checksum.</description> >>>> >>>> <group>syscheck,</group> >>>> >>>> </rule> >>>> >>>> >>>> >>>> Should it work with that rule or do I have to configure something else >>>> additionally? >>>> >>>> >>>> >>>> I hope someone knows that problem and can help me! >>>> >>>> >>>> >>>> Best regards, >>>> >>>> Thomas >>>> >>>> >>>> >>>> >>>> >>>> >>>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"* >>>> T-Systems Austria GesmbH Rennweg 97-99, 1030 Wien >>>> Handelsgericht Wien, FN 79340b >>>> >>>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"* >>>> Notice: This e-mail contains information that is confidential and may be >>>> privileged. >>>> If you are not the intended recipient, please notify the sender and then >>>> delete this e-mail immediately. >>>> >>>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"* > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
